iOS Internals · Inside iOS · Lesson 2 of 5

Code Signing & the App Store

See why every iPhone app must carry a signature, and who checks it.

Signed or it doesn't run

In module 1 you followed the chain of trust from the Boot ROM up to the kernel. Once the kernel is running, iOS keeps the chain going with a strict rule: all code that runs on the iPhone must be signed with a certificate issued by Apple.

A code signature is a digital seal attached to an app. It's made with a secret key that only the developer holds, and it covers every byte of the app's code. Change even one byte after signing and the seal no longer matches. A certificate is the ID card that goes with the seal. It says who made the app, and on iOS it has to be issued by Apple.

Getting a certificate isn't anonymous. A developer joins the Apple Developer Program, and Apple verifies who they really are before issuing one. Each developer account gets a Team ID, a 10-character code that's stamped into their certificates.

The checks happen while you use the phone, not just once. When an app launches, iOS checks its signature. It also checks the extra code libraries the app loads. Each one must either come with iOS or carry the same Team ID as the app, so an app can't quietly load code signed by a stranger.

You saw in Android App Security that Android developers sign apps with keys they create themselves. iOS goes a step further, because the certificate must come from Apple. That gives Apple a record of who is behind every app.

Why be so strict? Refusing unsigned code means:

• Malware can't simply be copied onto the phone and run.
• An app that has been tampered with, for example a popular app with spyware added, fails the check.
• Every app traces back to a developer whose identity Apple has checked.

How apps reach your iPhone

Signing proves who made an app. A second layer checks what the app does before it reaches you. There are a few official routes, and every one still requires signing.

• The App Store is the main route. Before an app appears, it goes through App Review, a mix of automated checks and people at Apple who test it against Apple's rules on safety, privacy, performance and content.
• TestFlight is Apple's app for testing unfinished versions, called betas. A developer can invite up to 10,000 outside testers, and the first build shared with them must pass a review too.
• Enterprise apps are for a company's own employees, such as an internal timesheet app. They skip the App Store. To use one, you install a profile from your employer, and the first time the app opens, the iPhone checks with Apple that it's allowed to run.
• Alternative app marketplaces arrived in the European Union with iOS 17.4 in March 2024, after a new EU law. People in the EU can install apps from other stores, or straight from some developers' websites. This only works if your Apple Account's country or region is in the EU and you're physically there.

Apps outside the App Store in the EU still go through notarization, a baseline review by Apple. It looks for known malware and checks that an app is honest about what it does and doesn't collect private data behind your back. It doesn't apply the App Store's content and business rules. Each marketplace makes its own rules about the rest, and Apple says it can't help with problems such as refunds from those stores.

Here's the safety lesson. Enterprise distribution is meant for employers. If a website or a stranger asks you to install a profile or trust a developer so you can get a free game or app, treat it as a scam.